Analysis
-
max time kernel
178s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 05:29
Behavioral task
behavioral1
Sample
76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e.exe
Resource
win10v2004-20221111-en
General
-
Target
76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e.exe
-
Size
292KB
-
MD5
dff8c770f17cbff873982a1434667220
-
SHA1
8b98c638a92f8e14e939a59001aae6fb8b27bbb7
-
SHA256
76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e
-
SHA512
d14084f317957b6e99c90b15d34dc13ad8caebf45d84e8cd24126730804fa4e5af002d4afac8baba9bc30f061211080dc3d017a54084e018ba8ae78f97e29cab
-
SSDEEP
6144:sN+HTr4epupf3/4YIJ8m1MxUyRzoVOBlYQflIGY:sNgrZ8P4BJTM6++OBlYERY
Malware Config
Signatures
-
Processes:
resource yara_rule C:\4a9f5c57.exe aspack_v212_v242 C:\4a9f5c57.exe aspack_v212_v242 \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll aspack_v212_v242 C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll aspack_v212_v242 \??\c:\windows\SysWOW64\irmon.dll aspack_v212_v242 C:\Windows\SysWOW64\Irmon.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nla.dll aspack_v212_v242 \??\c:\windows\SysWOW64\ntmssvc.dll aspack_v212_v242 C:\Windows\SysWOW64\Ntmssvc.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwcworkstation.dll aspack_v212_v242 C:\Windows\SysWOW64\Nla.dll aspack_v212_v242 C:\Windows\SysWOW64\NWCWorkstation.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwsapagent.dll aspack_v212_v242 C:\Windows\SysWOW64\Nwsapagent.dll aspack_v212_v242 \??\c:\windows\SysWOW64\srservice.dll aspack_v212_v242 C:\Windows\SysWOW64\SRService.dll aspack_v212_v242 \??\c:\windows\SysWOW64\wmdmpmsp.dll aspack_v212_v242 C:\Windows\SysWOW64\WmdmPmSp.dll aspack_v212_v242 \??\c:\windows\SysWOW64\logonhours.dll aspack_v212_v242 C:\Windows\SysWOW64\LogonHours.dll aspack_v212_v242 \??\c:\windows\SysWOW64\pcaudit.dll aspack_v212_v242 C:\Windows\SysWOW64\PCAudit.dll aspack_v212_v242 \??\c:\windows\SysWOW64\helpsvc.dll aspack_v212_v242 \??\c:\windows\SysWOW64\uploadmgr.dll aspack_v212_v242 C:\Windows\SysWOW64\helpsvc.dll aspack_v212_v242 C:\Windows\SysWOW64\uploadmgr.dll aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
4a9f5c57.exepid process 5068 4a9f5c57.exe -
Sets DLL path for service in the registry 2 TTPs 14 IoCs
Processes:
4a9f5c57.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll" 4a9f5c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 4a9f5c57.exe -
Processes:
resource yara_rule behavioral2/memory/3120-132-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\4a9f5c57.exe upx C:\4a9f5c57.exe upx behavioral2/memory/5068-136-0x0000000000700000-0x000000000074E000-memory.dmp upx behavioral2/memory/5068-137-0x0000000000700000-0x000000000074E000-memory.dmp upx behavioral2/memory/5068-138-0x0000000000700000-0x000000000074E000-memory.dmp upx \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll upx C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll upx behavioral2/memory/2020-142-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/2020-141-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/2020-143-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/3120-145-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\windows\SysWOW64\irmon.dll upx C:\Windows\SysWOW64\Irmon.dll upx behavioral2/memory/2216-150-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/2216-149-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/2216-151-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx \??\c:\windows\SysWOW64\nla.dll upx \??\c:\windows\SysWOW64\ntmssvc.dll upx C:\Windows\SysWOW64\Ntmssvc.dll upx behavioral2/memory/3628-157-0x0000000074C00000-0x0000000074C4E000-memory.dmp upx behavioral2/memory/3628-159-0x0000000074C00000-0x0000000074C4E000-memory.dmp upx behavioral2/memory/3628-161-0x0000000074C00000-0x0000000074C4E000-memory.dmp upx behavioral2/memory/3100-162-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx \??\c:\windows\SysWOW64\nwcworkstation.dll upx behavioral2/memory/3100-158-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/3100-156-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx C:\Windows\SysWOW64\Nla.dll upx C:\Windows\SysWOW64\NWCWorkstation.dll upx behavioral2/memory/972-165-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/972-164-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/972-166-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx \??\c:\windows\SysWOW64\nwsapagent.dll upx C:\Windows\SysWOW64\Nwsapagent.dll upx behavioral2/memory/1476-169-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/1476-170-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx behavioral2/memory/1476-171-0x0000000074C50000-0x0000000074C9E000-memory.dmp upx \??\c:\windows\SysWOW64\srservice.dll upx C:\Windows\SysWOW64\SRService.dll upx behavioral2/memory/628-174-0x0000000074BC0000-0x0000000074C0E000-memory.dmp upx behavioral2/memory/628-175-0x0000000074BC0000-0x0000000074C0E000-memory.dmp upx behavioral2/memory/628-176-0x0000000074BC0000-0x0000000074C0E000-memory.dmp upx \??\c:\windows\SysWOW64\wmdmpmsp.dll upx C:\Windows\SysWOW64\WmdmPmSp.dll upx behavioral2/memory/2896-181-0x0000000074550000-0x000000007459E000-memory.dmp upx behavioral2/memory/2896-182-0x0000000074550000-0x000000007459E000-memory.dmp upx behavioral2/memory/2896-180-0x0000000074550000-0x000000007459E000-memory.dmp upx behavioral2/memory/2896-179-0x0000000074550000-0x000000007459E000-memory.dmp upx \??\c:\windows\SysWOW64\logonhours.dll upx C:\Windows\SysWOW64\LogonHours.dll upx behavioral2/memory/4524-185-0x0000000074550000-0x000000007459E000-memory.dmp upx behavioral2/memory/4524-186-0x0000000074550000-0x000000007459E000-memory.dmp upx behavioral2/memory/4524-187-0x0000000074550000-0x000000007459E000-memory.dmp upx \??\c:\windows\SysWOW64\pcaudit.dll upx C:\Windows\SysWOW64\PCAudit.dll upx \??\c:\windows\SysWOW64\helpsvc.dll upx behavioral2/memory/5068-193-0x0000000000700000-0x000000000074E000-memory.dmp upx \??\c:\windows\SysWOW64\uploadmgr.dll upx C:\Windows\SysWOW64\helpsvc.dll upx behavioral2/memory/2488-196-0x0000000074550000-0x000000007459E000-memory.dmp upx behavioral2/memory/2796-199-0x0000000074500000-0x000000007454E000-memory.dmp upx behavioral2/memory/2796-200-0x0000000074500000-0x000000007454E000-memory.dmp upx C:\Windows\SysWOW64\uploadmgr.dll upx behavioral2/memory/2488-197-0x0000000074550000-0x000000007459E000-memory.dmp upx -
Loads dropped DLL 12 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 2020 svchost.exe 2216 svchost.exe 3100 svchost.exe 3628 svchost.exe 972 svchost.exe 1476 svchost.exe 628 svchost.exe 2896 svchost.exe 4524 svchost.exe 2492 svchost.exe 2488 svchost.exe 2796 svchost.exe -
Drops file in System32 directory 14 IoCs
Processes:
4a9f5c57.exedescription ioc process File opened for modification C:\Windows\SysWOW64\LogonHours.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\SRService.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\Wmi.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\PCAudit.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\NWCWorkstation.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\Nwsapagent.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\uploadmgr.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\Nla.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\helpsvc.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\Irmon.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\Ntmssvc.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\WmdmPmSp.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 4a9f5c57.exe File opened for modification C:\Windows\SysWOW64\Ias.dll 4a9f5c57.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4a9f5c57.exepid process 5068 4a9f5c57.exe 5068 4a9f5c57.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e.exedescription pid process target process PID 3120 wrote to memory of 5068 3120 76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e.exe 4a9f5c57.exe PID 3120 wrote to memory of 5068 3120 76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e.exe 4a9f5c57.exe PID 3120 wrote to memory of 5068 3120 76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e.exe 4a9f5c57.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e.exe"C:\Users\Admin\AppData\Local\Temp\76d7a9eda2416f4f3f024538108dc3cdbb183e53917ccde16f85b2ef3715442e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\4a9f5c57.exeC:\4a9f5c57.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\4a9f5c57.exeFilesize
240KB
MD5f5d2a6e81cd9b23d4899371b296b8a8c
SHA17b095e73b522c5a1b12e26ae389464c5c123bc8e
SHA256775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42
SHA51277842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662
-
C:\4a9f5c57.exeFilesize
240KB
MD5f5d2a6e81cd9b23d4899371b296b8a8c
SHA17b095e73b522c5a1b12e26ae389464c5c123bc8e
SHA256775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42
SHA51277842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662
-
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Irmon.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\LogonHours.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\NWCWorkstation.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Nla.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Ntmssvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Nwsapagent.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\PCAudit.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\SRService.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\WmdmPmSp.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\helpsvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\uploadmgr.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\helpsvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\irmon.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\logonhours.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nla.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\ntmssvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nwcworkstation.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nwsapagent.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\pcaudit.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\srservice.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\uploadmgr.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\wmdmpmsp.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
memory/628-174-0x0000000074BC0000-0x0000000074C0E000-memory.dmpFilesize
312KB
-
memory/628-175-0x0000000074BC0000-0x0000000074C0E000-memory.dmpFilesize
312KB
-
memory/628-176-0x0000000074BC0000-0x0000000074C0E000-memory.dmpFilesize
312KB
-
memory/972-164-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/972-165-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/972-166-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/1476-169-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/1476-171-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/1476-170-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/2020-142-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/2020-143-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/2020-141-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/2216-150-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/2216-151-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/2216-149-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/2488-196-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/2488-201-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/2488-197-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/2796-199-0x0000000074500000-0x000000007454E000-memory.dmpFilesize
312KB
-
memory/2796-200-0x0000000074500000-0x000000007454E000-memory.dmpFilesize
312KB
-
memory/2796-202-0x0000000074500000-0x000000007454E000-memory.dmpFilesize
312KB
-
memory/2896-181-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/2896-182-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/2896-180-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/2896-179-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/3100-158-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/3100-156-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/3100-162-0x0000000074C50000-0x0000000074C9E000-memory.dmpFilesize
312KB
-
memory/3120-145-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/3120-132-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/3628-159-0x0000000074C00000-0x0000000074C4E000-memory.dmpFilesize
312KB
-
memory/3628-157-0x0000000074C00000-0x0000000074C4E000-memory.dmpFilesize
312KB
-
memory/3628-161-0x0000000074C00000-0x0000000074C4E000-memory.dmpFilesize
312KB
-
memory/4524-186-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/4524-185-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/4524-187-0x0000000074550000-0x000000007459E000-memory.dmpFilesize
312KB
-
memory/5068-138-0x0000000000700000-0x000000000074E000-memory.dmpFilesize
312KB
-
memory/5068-146-0x00000000028B0000-0x00000000068B0000-memory.dmpFilesize
64.0MB
-
memory/5068-136-0x0000000000700000-0x000000000074E000-memory.dmpFilesize
312KB
-
memory/5068-133-0x0000000000000000-mapping.dmp
-
memory/5068-137-0x0000000000700000-0x000000000074E000-memory.dmpFilesize
312KB
-
memory/5068-193-0x0000000000700000-0x000000000074E000-memory.dmpFilesize
312KB
-
memory/5068-144-0x00000000028B0000-0x00000000068B0000-memory.dmpFilesize
64.0MB